Cubist Role Access Tokens API

openapi: 3.2.0
info:
  title: CubeSigner Account Role Access Tokens API
  description: The CubeSigner management and signing service.
  contact:
    name: Cubist Inc.
    email: hello@cubist.dev
  version: v0.1.0
servers:
- url: https://gamma.signer.cubist.dev
  description: Testing and staging environment
- url: https://prod.signer.cubist.dev
  description: Production environment
security:
- Cognito: []
tags:
- name: Role Access Tokens
paths:
  /v0/org/{org_id}/roles/{role_id}/tokens:
    post:
      tags:
      - Role Access Tokens
      summary: Create Token
      description: 'Create Token


        Creates a new access token for a given role (to be used as "API Key" for all signing actions).

        The `restricted_actions` field on the [Role] determines the membership role that is required to

        create tokens.'
      operationId: createRoleToken
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      - name: role_id
        in: path
        description: Name or ID of the desired Role
        required: true
        schema:
          type: string
        example: Role#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateTokenRequest'
        required: true
      responses:
        '200':
          $ref: '#/components/responses/NewSessionResponse'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:session:create
  /v0/org/{org_id}/token/keys:
    get:
      tags:
      - Role Access Tokens
      summary: Get Token-Accessible Keys
      description: 'Get Token-Accessible Keys


        Retrieves the keys that a user or role session can access.'
      operationId: listTokenKeys
      parameters:
      - name: org_id
        in: path
        description: Name or ID of the desired Org
        required: true
        schema:
          type: string
        example: Org#124dfe3e-3bbd-487d-80c0-53c55e8ab87a
      responses:
        '200':
          $ref: '#/components/responses/KeyInfos'
        default:
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      security:
      - SignerAuth:
        - manage:key:get
components:
  schemas:
    PreconditionErrorOwnCodes:
      type: string
      enum:
      - FailOnMfaRequired
      - KeyRegionLocked
      - KeyRegionChangedRecently
      - MfaRegionLocked
      - Eth2ProposerSlotTooLow
      - Eth2AttestationSourceEpochTooLow
      - Eth2AttestationTargetEpochTooLow
      - Eth2ConcurrentBlockSigning
      - Eth2ConcurrentAttestationSigning
      - Eth2MultiDepositToNonGeneratedKey
      - Eth2MultiDepositUnknownInitialDeposit
      - Eth2MultiDepositWithdrawalAddressMismatch
      - ConcurrentSigningWhenTimeLimitPolicyIsDefined
      - BabylonEotsConcurrentSigning
      - TendermintStateError
      - TendermintConcurrentSigning
      - MfaApprovalsNotYetValid
    EditPolicy:
      type: object
      description: 'A policy which governs when and who is allowed to update the entity this policy is

        attached to (e.g., a role or a key).


        When attached to a role, by default, this policy applies to role deletion and all

        role updates (including adding/removing keys and users); in terms of scopes,

        it applies to `manage:role:update:*` and `manage:role:delete`.


        When attached to a key, by default, this policy applies to key deletion, all

        key updates, and adding/removing that key to/from a role; in terms of scopes,

        it applies to `manage:key:update:*`, `manage:key:delete`, `manage:role:update:key:*`.


        This default can be changed by setting the `applies_to_scopes` property.'
      properties:
        applies_to_scopes:
          $ref: '#/components/schemas/ScopeSet'
        mfa:
          allOf:
          - $ref: '#/components/schemas/MfaPolicy'
        time_lock_until:
          allOf:
          - $ref: '#/components/schemas/EpochDateTime'
    BadRequestErrorCode:
      type: string
      enum:
      - GenericBadRequest
      - DisallowedAllowRuleReference
      - InvalidPaginationToken
      - InvalidEmail
      - InvalidEmailTemplate
      - QueryMetricsError
      - InvalidTelegramData
      - ValidationError
      - WebhookPolicyTimeoutOutOfBounds
      - WebhookPolicyDisallowedUrlScheme
      - WebhookPolicyDisallowedUrlHost
      - WebhookPolicyDisallowedHeaders
      - ReservedName
      - UserEmailNotConfigured
      - EmailPasswordNotFound
      - PasswordAuthNotAllowedByInvitation
      - OneTimeCodeExpired
      - InvalidBody
      - InvalidJwt
      - InvitationNoLongerValid
      - TokenRequestError
      - InvalidMfaReceipt
      - InvalidMfaPolicyCount
      - InvalidMfaPolicyNumAuthFactors
      - InvalidMfaPolicyNumAllowedApprovers
      - InvalidMfaPolicyGracePeriodTooLong
      - InvalidBabylonStakingPolicyParams
      - InvalidSuiTxReceiversEmptyAllowlist
      - InvalidBtcTxReceiversEmptyAllowlist
      - InvalidRequireRoleSessionAllowlist
      - InvalidCreateKeyCount
      - InvalidDiffieHellmanCount
      - OrgInviteExistingUser
      - OrgUserAlreadyExists
      - OrgNameTaken
      - KwkNotFoundInRegion
      - OrgIsNotOrgExport
      - RoleNameTaken
      - PolicyNameTaken
      - NameTaken
      - ContactNameInvalid
      - ContactAddressesInvalid
      - ContactLabelInvalid
      - ContactModified
      - PolicyNotFound
      - PolicyVersionNotFound
      - PolicyRuleDisallowedByType
      - PolicyTypeDisallowed
      - PolicyDuplicateError
      - PolicyStillAttached
      - PolicyModified
      - PolicyNotAttached
      - AddKeyToRoleCountTooHigh
      - InvalidKeyId
      - InvalidTimeLockAlreadyInThePast
      - InvalidRestrictedScopes
      - InvalidUpdate
      - InvalidMetadataLength
      - InvalidLength
      - InvalidKeyMaterialId
      - KeyNotFound
      - SiweChallengeNotFound
      - SiweInvalidRequest
      - SiwsChallengeNotFound
      - SiwsInvalidRequest
      - UserExportDerivedKey
      - UserExportPublicKeyInvalid
      - NistP256PublicKeyInvalid
      - UnableToAccessSmtpRelay
      - UserExportInProgress
      - RoleNotFound
      - InvalidRoleNameOrId
      - InvalidMfaReceiptOrgIdMissing
      - InvalidMfaReceiptInvalidOrgId
      - MfaRequestNotFound
      - InvalidKeyType
      - InvalidPropertiesForKeyType
      - MismatchedKeyPropertiesPatch
      - MissingBinanceApiKey
      - MissingBybitApiKey
      - MissingCoinbaseApiKey
      - BinanceKeyMasterMismatch
      - BybitAccountMismatch
      - InvalidKeyMaterial
      - InvalidHexValue
      - InvalidBase32Value
      - InvalidBase58Value
      - InvalidBase64Value
      - InvalidSs58Value
      - InvalidForkVersionLength
      - InvalidEthAddress
      - InvalidStellarAddress
      - InvalidOrgNameOrId
      - InvalidUpdateOrgRequestDisallowedMfaType
      - InvalidUpdateOrgRequestEmptyAllowedMfaTypes
      - EmailOtpDelayTooShortForRegisterMfa
      - InvalidStakeDeposit
      - InvalidBlobSignRequest
      - InvalidDiffieHellmanRequest
      - InvalidSolanaSignRequest
      - InvalidEip712SignRequest
      - InvalidEip7702SignRequest
      - OnlySpecifyOne
      - IncompatibleParams
      - NoOidcDataInProof
      - InvalidEvmSignRequest
      - InvalidEth2SignRequest
      - InvalidDeriveKeyRequest
      - InvalidStakingAmount
      - CustomStakingAmountNotAllowedForWrapperContract
      - InvalidUnstakeRequest
      - InvalidCreateUserRequest
      - UserAlreadyExists
      - IdpUserAlreadyExists
      - CognitoUserAlreadyOrgMember
      - UserNotFound
      - UserWithEmailNotFound
      - PolicyKeyMismatch
      - EmptyScopes
      - InvalidScopesForRoleSession
      - InvalidLifetime
      - NoSingleKeyForUser
      - InvalidOrgPolicyRule
      - SourceIpAllowlistEmpty
      - LimitWindowTooLong
      - Erc20ContractDisallowed
      - EmptyRuleError
      - PolicyFieldValidationError
      - OptionalListEmpty
      - MultipleExclusiveFieldsProvided
      - DuplicateFieldEntry
      - InvalidRange
      - InvalidOrgPolicyRepeatedRule
      - InvalidSuiTransaction
      - SuiSenderMismatch
      - AvaSignHashError
      - AvaSignError
      - BtcSegwitHashError
      - BtcTaprootHashError
      - BtcSignError
      - TaprootSignError
      - Eip712SignError
      - InvalidMemberRoleInUserAdd
      - InvalidMemberRoleInRecipientAdd
      - ThirdPartyUserAlreadyExists
      - OidcIdentityAlreadyExists
      - UserAlreadyHasIdentity
      - ThirdPartyUserNotFound
      - DeleteOidcUserError
      - DeleteUserError
      - SessionRoleMismatch
      - InvalidOidcToken
      - InvalidOidcIdentity
      - OidcIssuerUnsupported
      - OidcIssuerNotAllowed
      - OidcIssuerNoApplicableJwk
      - FidoKeyAlreadyRegistered
      - FidoKeySignCountTooLow
      - FidoVerificationFailed
      - FidoChallengeMfaMismatch
      - UnsupportedLegacyCognitoSession
      - InvalidIdentityProof
      - PaginationDataExpired
      - ExistingKeysViolateExclusiveKeyAccess
      - ExportDelayTooShort
      - ExportWindowTooLong
      - InvalidTotpFailureLimit
      - InvalidEip191SignRequest
      - CannotResendUserInvitation
      - InvalidNotificationEndpointCount
      - CannotDeletePendingSubscription
      - InvalidNotificationUrlProtocol
      - EmptyOneOfOrgEventFilter
      - EmptyAllExceptOrgEventFilter
      - InvalidTapNodeHash
      - InvalidOneTimeCode
      - MessageNotFound
      - MessageAlreadySigned
      - MessageRejected
      - MessageReplaced
      - InvalidMessageType
      - EmptyAddress
      - InvalidEth2SigningPolicySlotRange
      - InvalidEth2SigningPolicyEpochRange
      - InvalidEth2SigningPolicyTimestampRange
      - InvalidEth2SigningPolicyOverlappingRule
      - RpcUrlMissing
      - MmiChainIdMissing
      - EthersInvalidRpcUrl
      - EthersGetTransactionCountError
      - InvalidPassword
      - BabylonStakingFeePlusDustOverflow
      - BabylonStaking
      - BabylonStakingIncorrectKey
      - BabylonStakingSegwitNonDeposit
      - BabylonStakingRegistrationRequiresTaproot
      - PsbtSigning
      - TooManyResets
      - TooManyRequests
      - TooManyFailedLogins
      - BadBtcMessageSignP2shFlag
      - InvalidTendermintRequest
      - PolicyVersionMaxReached
      - PolicyVersionInvalid
      - PolicySecretLimitReached
      - PolicySecretTooLarge
      - InvalidImportKey
      - AlienOwnerInvalid
      - EmptyUpdateRequest
      - InvalidPolicyReference
      - PolicyEngineDisabled
      - InvalidWasmPolicy
      - CelProgramTooLarge
      - InvalidPolicy
      - RedundantDerivationPath
      - ImportKeyMissing
      - InvalidAbiMethods
      - BabylonCovSign
      - InvalidPolicyLogsRequest
      - UserProfileMigrationMultipleEntries
      - UserProfileMigrationTooManyItems
      - InputTooShort
      - InvalidTweakLength
      - InvalidCustomChains
      - InvalidRpcRequest
    MfaRequiredArgs:
      type: object
      required:
      - id
      - ids
      - org_id
      properties:
        id:
          type: string
          description: Always set to first MFA id from `Self::ids`
        ids:
          type: array
          items:
            type: string
            minLength: 1
          description: Non-empty MFA request IDs
        org_id:
          type: string
          description: Organization id
        policy_eval_tree:
          description: Optional policy evaluation tree (included in signer responses, when requested)
        session:
          allOf:
          - $ref: '#/components/schemas/NewSessionResponse'
    PreconditionErrorCode:
      oneOf:
      - $ref: '#/components/schemas/PreconditionErrorOwnCodes'
      - $ref: '#/components/schemas/PolicyErrorCode'
    AcceptedValueCode:
      type: string
      enum:
      - SignDryRun
      - BinanceDryRun
      - BybitDryRun
      - CoinbaseDryRun
      - MfaRequired
    PolicyErrorOwnCodes:
      type: string
      enum:
      - Inapplicable
      - SuiTxReceiversDisallowedTransactionKind
      - SuiTxReceiversDisallowedTransferAddress
      - SuiTxReceiversDisallowedCommand
      - BtcTxDisallowedOutputs
      - BtcSignatureExceededValue
      - BtcValueOverflow
      - BtcSighashTypeDisallowed
      - Eip7702AddressMismatch
      - EvmTxReceiverMismatch
      - EvmTxChainIdMismatch
      - EvmTxSenderMismatch
      - EvmTxExceededValue
      - EvmTxExceededGasCost
      - EvmTxGasCostUndefined
      - EvmDataDisallowed
      - Erc20DataInvalid
      - EvmContractAddressUndefined
      - EvmContractChainIdUndefined
      - EvmDataNotDefined
      - EvmDataInvalid
      - EvmContractNotInAllowlist
      - Erc20ExceededTransferLimit
      - Erc20ReceiverMismatch
      - Erc20ExceededApproveLimit
      - Erc20SpenderMismatch
      - EvmFunctionNotInAllowlist
      - EvmFunctionCallInvalid
      - EvmFunctionCallDisallowedArg
      - PolicyDisjunctionError
      - PolicyNegationError
      - Eth2ExceededMaxUnstake
      - Eth2ConcurrentUnstaking
      - NotInIpv4Allowlist
      - NotInOriginAllowlist
      - NotInOperationAllowlist
      - InvalidSourceIp
      - RawSigningNotAllowed
      - DiffieHellmanExchangeNotAllowed
      - Eip712SigningNotAllowed
      - OidcSourceNotAllowed
      - NoOidcAuthSourcesDefined
      - AddKeyToRoleDisallowed
      - KeysAlreadyInRole
      - KeyInMultipleRoles
      - KeyAccessError
      - RequireRoleSessionKeyAccessError
      - BtcMessageSigningNotAllowed
      - Eip191SigningNotAllowed
      - Eip7702SigningNotAllowed
      - TaprootSigningDisallowed
      - SegwitSigningDisallowed
      - PsbtSigningDisallowed
      - BabylonStakingDisallowed
      - TimeLocked
      - CelPolicyDenied
      - BabylonStakingNetwork
      - BabylonStakingParamsVersion
      - BabylonStakingExplicitParams
      - BabylonStakingStakerPk
      - BabylonStakingFinalityProviderPk
      - BabylonStakingLockTime
      - BabylonStakingValue
      - BabylonStakingChangeAddress
      - BabylonStakingFee
      - BabylonStakingWithdrawalAddress
      - BabylonStakingBbnAddress
      - SolanaInstructionCountLow
      - SolanaInstructionCountHigh
      - SolanaNotInInstructionAllowlist
      - SolanaInstructionMismatch
      - WasmPoliciesDisabled
      - WasmPolicyDenied
      - WasmPolicyFailed
      - WebhookPoliciesDisabled
      - DeniedByWebhook
      - ExplicitlyDenied
    ClientSessionMetadata:
      type: object
      description: Attributes that are expected to be provided by the client
      properties:
        client:
          $ref: '#/components/schemas/ClientProfile'
        os_info:
          $ref: '#/components/schemas/OsInfo'
    AcceptedValue:
      oneOf:
      - type: object
        required:
        - SignDryRun
        properties:
          SignDryRun:
            $ref: '#/components/schemas/SignDryRunArgs'
      - type: object
        required:
        - BinanceDryRun
        properties:
          BinanceDryRun:
            $ref: '#/components/schemas/BinanceDryRunArgs'
      - type: object
        required:
        - BybitDryRun
        properties:
          BybitDryRun:
            $ref: '#/components/schemas/BybitDryRunArgs'
      - type: object
        required:
        - CoinbaseDryRun
        properties:
          CoinbaseDryRun:
            $ref: '#/components/schemas/CoinbaseDryRunArgs'
      - type: object
        required:
        - MfaRequired
        properties:
          MfaRequired:
            $ref: '#/components/schemas/MfaRequiredArgs'
      description: Different responses we return for success status codes.
    CreateTokenRequest:
      allOf:
      - $ref: '#/components/schemas/RatchetConfig'
      - $ref: '#/components/schemas/ClientSessionMetadata'
      - type: object
        required:
        - purpose
        properties:
          purpose:
            type: string
            description: A human readable description of the purpose of the key
            example: Validator Signing
          scopes:
            type:
            - array
            - 'null'
            items:
              $ref: '#/components/schemas/Scope'
            description: 'Controls what capabilities this session will have. By default, it has all

              signing capabilities, i.e., just the ''sign:*'' scope.'
            example:
            - sign:*
            minItems: 1
    ClientProfile:
      type: object
      description: Client information representing the nature of front-end in [`ClientSessionMetadata`] and reflected in [`SessionMetadata`].
      properties:
        agent:
          type:
          - string
          - 'null'
          description: Agent/Product name
          example: Mozilla Firefox
        engine:
          type:
          - string
          - 'null'
          description: Name of the engine
          example: Gecko
        version:
          type:
          - string
          - 'null'
          description: Agent/product version
          example: '41.2'
    Id:
      type: string
    ForbiddenErrorCode:
      type: string
      enum:
      - AlienKeyCreate
      - CannotAssumeIdentity
      - SentryDisallowed
      - PasskeyLoginDisabled
      - PasskeyNotRegistered
      - CannotCreateOrg
      - WrongMfaEmailOtpJwt
      - OrgFlagNotSet
      - FidoRequiredToRemoveTotp
      - OidcIdentityLimitReached
      - OidcScopeCeilingMissing
      - OidcIssuerNotAllowedForMemberRole
      - OidcNoMemberRolesAllowed
      - EmailOtpNotConfigured
      - MfaChallengeExpired
      - ChainIdNotAllowed
      - InvalidOrg
      - OrgIdMismatch
      - SessionForWrongOrg
      - SelfDelete
      - SelfDisable
      - SelfMfaReset
      - InvalidOrgMembershipRoleChange
      - UserDisabled
      - OrgDisabled
      - OrgNotFound
      - OrgWithoutOwner
      - OrphanedUser
      - OidcUserNotFound
      - UserNotInOrg
      - UserNotOrgOwner
      - UserNotKeyOwner
      - InvalidRole
      - DisabledRole
      - KeyDisabled
      - KeyNotInRole
      - ContactNotInOrg
      - UserExportRequestNotInOrg
      - UserExportRequestInvalid
      - UserExportDisabled
      - UserNotOriginalKeyOwner
      - UserNotInRole
      - MustBeFullMember
      - SessionExpired
      - SessionChanged
      - SessionRevoked
      - ExpectedUserSession
      - SessionRoleChanged
      - ScopedNameNotFound
      - SessionInvalidEpochToken
      - SessionInvalidRefreshToken
      - SessionRefreshTokenExpired
      - InvalidAuthHeader
      - SessionNotFound
      - InvalidArn
      - SessionInvalidAuthToken
      - SessionAuthTokenExpired
      - SessionPossiblyStolenToken
      - MfaDisallowedIdentity
      - MfaDisallowedApprover
      - MfaTypeNotAllowed
      - MfaNotApprovedYet
      - MfaConfirmationCodeMismatch
      - MfaHttpRequestMismatch
      - MfaRemoveBelowMin
      - MfaOrgRequirementNotMet
      - MfaRegistrationDisallowed
      - TotpAlreadyConfigured
      - TotpConfigurationChanged
      - MfaTotpBadConfiguration
      - MfaTotpBadCode
      - MfaTotpRateLimit
      - ImproperSessionScope
      - FullSessionRequired
      - SessionWithoutAnyScopeUnder
      - UserRoleUnprivileged
      - MemberRoleForbidden
      - MfaNotConfigured
      - RemoveLastOidcIdentity
      - OperationNotAllowed
      - OrgExportRetrievalDisabled
      - ChangingKeyExportRequirementIsDisabled
      - AutoAddBlsKeyToProtectedRole
      - UserNotPolicyOwner
      - UserNotContactOwner
      - UserNotBucketOwner
      - LegacySessionCannotHaveScopeCeiling
      - RoleInParentOrgNotAllowed
      - RemoveKeyFromRoleUserNotAllowed
      - SiweChallengeExpired
      - SiweMessageNotValid
      - SiweMessageInvalidSignature
      - SiwsChallengeExpired
      - SiwsDomain
      - SiwsMessageInvalid
      - Acl
    BinanceApiPropertiesPatch:
      type: object
      properties:
        api_key:
          type:
          - string
          - 'null'
          description: The Binance-issued API key string. Encrypted server-side before storage.
        email:
          type:
          - string
          - 'null'
          description: Email address of the Binance (master or sub) account this key authenticates as.
        is_master:
          type:
          - boolean
          - 'null'
          description: Whether this corresponds to a master (as opposed to a sub) account on Binance.
        label:
          type:
          - string
          - 'null'
          description: Arbitrary label. Useful for storing the corresponding API key label on the Binance side.
        sub_of:
          type:
          - string
          - 'null'
          description: 'If this is a sub-account, this field can be used to link it to its master account

            (by providing the master account email, which Binance uses as an account identifier).'
    Seconds:
      type: integer
      format: int64
      description: 'Duration measured in seconds

        A wrapper type for serialization that encodes a `Duration` as a `u64` representing the number of seconds.'
      minimum: 0
    OperationKind:
      type: string
      description: All different kinds of sensitive operations
      enum:
      - AvaSign
      - AvaChainTxSign
      - BabylonCovSign
      - BabylonRegistration
      - BabylonStaking
      - BinanceSubToMaster
      - BinanceSubToSub
      - BinanceUniversalTransfer
      - BinanceSubAccountAssets
      - BinanceAccountInfo
      - BinanceSubAccountTransferHistory
      - BinanceUniversalTransferHistory
      - BinanceWithdraw
      - BinanceWithdrawHistory
      - BinanceDeposit
      - BinanceDepositHistory
      - BinanceListSubAccounts
      - BinanceCoinInfo
      - BlobSign
      - BtcMessageSign
      - BtcSign
      - BybitQueryUser
      - BybitQuerySubMembers
      - BybitQueryCoinsBalance
      - BybitQueryDepositAddress
      - BybitUniversalTransfer
      - BybitWithdraw
      - BybitWithdrawals
      - CoinbaseListAccounts
      - CoinbaseListPortfolios
      - CoinbaseMoveFunds
      - DiffieHellman
      - PsbtSign
      - TaprootSign
      - Eip191Sign
      - Eip712Sign
      - Eip7702Sign
      - EotsNonces
      - EotsSign
      - Eth1Sign
      - Eth2Sign
      - Eth2Stake
      - Eth2Unstake
      - SolanaSign
      - SuiSign
      - TendermintSign
      - RoleUpdate
    UnauthorizedErrorCode:
      type: string
      enum:
      - AuthorizationHeaderMissing
      - EndpointRequiresUserSession
      - RefreshTokenMissing
    SignerErrorOwnCodes:
      type: string
      enum:
      - PreComputed
      - StatusCodeWithMessage
      - JrpcError
      - UnhandledError
      - ProxyStartError
      - EnclaveError
      - PolicyErrorWithEvalTree
      - RpcApi
    SignDryRunArgs:
      type: object
      required:
      - mfa_requests
      properties:
        mfa_requests:
          type: array
          items:
            $ref: '#/components/schemas/MfaRequestInfo'
          description: Whether MFA is required
        policy_eval_tree:
          description: Optional policy evaluation tree, if requested
    ScopeSet:
      oneOf:
      - type: string
        description: All scopes
        enum:
        - All
      - type: object
        required:
        - AllExcept
        properties:
          AllExcept:
            type: array
            items:
              $ref: '#/components/schemas/Scope'
            description: All scopes except these (including those transitively implied).
      - type: object
        required:
        - AllOf
        properties:
          AllOf:
            type: array
            items:
              $ref: '#/components/schemas/Scope'
            description: All of these scopes (including those transitively implied).
      description: A set of scopes.
    EpochDateTime:
      type: integer
      format: int64
      description: 'DateTime measured in seconds since unix epoch.

        A wrapper type for serialization that encodes a [`SystemTime`] as a [`u64`]

        representing the number of seconds since [`SystemTime::UNIX_EPOCH`].'
      minimum: 0
    RatchetConfig:
      type: object
      properties:
        auth_lifetime:
          type: integer
          format: int64
          description: 'The lifetime (in seconds) of auth tokens for this session.

            Auth tokens can be refreshed (renewed) using a valid (unexpired)

            refresh token, but not beyond the session lifetime.'
          default: 300
          example: 3600
          minimum: 0
        grace_lifetime:
          type: integer
          format: int64
          description: 'The amount of time (in seconds) that an auth token for this session remains

            valid after it has been refreshed and a new auth token has been issued. This

            helps to address concurrency hazards, for example, if one thread makes requests

            with auth token while another refreshes it.'
          default: 30
          example: 30
          minimum: 0
        refresh_lifetime:
          type: integer
          format: int64
          description: 'The lifetime (in seconds) of refresh tokens for this session.

            If this value is shorter than the session lifetime, inactive sessions

            will become invalid once the auth and refresh tokens have both expired.'
          default: 86400
          example: 43200
          minimum: 0
        session_lifetime:
          type: integer
          format: int64
          description: 'The lifetime (in seconds) of the session.

            The session cannot be extended beyond its original lifetime.'
          default: 31536000
          example: 86400
          minimum: 0
    B32:
      type: string
      description: Wrapper around a zeroizing 32-byte fixed-size array
    CoinbaseDryRunArgs:
      type: object
      required:
      - method
      - url
      properties:
        method:
          type: string
          description: The Coinbase API method that would have been used
        url:
          type: string
          description: The Coinbase API url method that would have been called
    ErrorResponse:
      type: object
      description: The structure of ErrorResponse must match the response template that AWS uses
      required:
      - message
      - error_code
      properties:
        accepted:
          allOf:
          - $ref: '#/components/schemas/AcceptedValue'
        error_code:
          $ref: '#/components/schemas/SignerErrorCode'
        message:
          type: string
          description: Error message
        policy_eval_tree:
          description: Optional policy evaluation tree (included in signer responses, when requested)
        request_id:
          type: string
          description: Optional request identifier
    NotFoundErrorCode:
      type: string
      enum:
      - UriSegmentMissing
      - UriSegmentInvalid
      - TotpNotConfigured
      - FidoKeyNotFound
      - FidoChallengeNotFound
      - TotpChallengeNotFound
      - UserExportRequestNotFound
      - UserExportCiphertextNotFound
      - OrgExportCiphertextNotFound
      - UploadObjectNotFound
      - PolicySecretNotFound
      - BucketMetaNotFound
      - TimestreamDisabled
      - CustomChainNotFound
      - InvitationNotFound
      - TransactionNotFound
      - EmailConfigNotFound
    ConflictErrorCode:
      type: string
      enum:
      - ConcurrentRequestDisallowed
      - ConcurrentLockCreation
    CommonFields:
      allOf:
      - type: object
        description: 'Versioning fields (e.g., version number, creation time, and last modified times)

          that are common to different types of resources.'
        properties:
          created:
            allOf:
            - $ref: '#/components/schemas/EpochDateTime'
          last_modified:
            allOf:
            - $ref: '#/components/schemas/EpochDateTime'
          version:
            type: integer
            format: int64
            description: Version of this object
            minimum: 0
      - type: object
        properties:
          edit_policy:
            $ref: '#/components/schemas/EditPolicy'
          metadata:
            description: 'User-defined metadata. When rendering (e.g., in the browser) you should treat

              it as untrusted user data (and avoid injecting metadata into HTML directly) if

              untrusted users can create/update keys (or their metadata).'
      description: 'Fields that are common to different types of resources such as keys, roles, etc.

        Includes versioning fields plus metadata, edit policy, etc.'
    SignerErrorCode:
      oneOf:
      - $ref: '#/components/schemas/SignerErrorOwnCodes'
      - $ref: '#/components/schemas/AcceptedValueCode'
      - $ref: '#/components/schemas/BadRequestErrorCode'
      - $ref: '#/components/schemas/BadGatewayErrorCode'
      - $ref: '#/components/schemas/NotFoundErrorCode'
      - $ref: '#/components/schemas/ForbiddenErrorCode'
      - $ref: '#/components/schemas/UnauthorizedErrorCode'
      - $ref: '#/components/schemas/PreconditionErrorCode'
      - $ref: '#/components/schemas/TimeoutErrorCode'
      - $ref: '#/components/schemas/ConflictErrorCode'
      - $ref: '#/components/schemas/InternalErrorCode'
    BybitDryRunArgs:
      type: object
      required:
      - method
      - url
      - payload
      properties:
        method:
          type: string
          description: The Bybit API method that would have been used
        payload:
          type: string
          description: The request body (for POST endpoints) or query string (for GET endpoints).
        url:
          type: string
          description: The Bybit API url that would have been called
    PolicyErrorCode:
      oneOf:
      - $ref: '#/components/schemas/PolicyErrorOwnCodes'
      - $ref: '#/components/schemas/EvmTxDepositErrorCode'
    OsInfo:
      type: object
      description: OS information set in [`ClientSessionMetadata`] and reflected in [`SessionMetadata`]
      properties:
        architecture:
          type:
          - string
          - 'null'
          example: arm64
        name:
          type:
          - string
          - 'null'
          example: Mac OS
        version:
          type:
          - string
          - 'null'
          example: 14.5.0
        word_size:
          type:
          - string
          - 'null'
          example: 64-bit
    MfaType:
      type: string
      format: '''CubeSigner'' | ''Fido'' | `FidoKey#${string}` | ''Totp'' | ''EmailOtp'' | `EmailOtp#${number}`'
      description: Different types that can be used to approve an MFA request
      pattern: ^(CubeSigner|Totp|EmailOtp|EmailOtp#\d+|Fido|FidoKey#[^#\s]+)$
    KeyDerivationInfo:
      type: object
      description: Derivation-related metadata for keys derived from a long-lived mnemonic
      required:
      - mnemonic_id
      - derivation_path
      properties:
        derivation_path:
          type: string
          description: The derivation path used to derive this key
        mnemonic_id:
          type: string
          description: The mnemonic-id of the key's parent mnemonic
    Scope:
      oneOf:
      - $ref: '#/components/schemas/ExplicitScope'
      - type: string
        title: OtherScopes
        description: Scopes including wildcard fragments for accessing CubeSigner APIs
        pattern: ^(orgAccess:child)(:[^:]+)?$
      description: All scopes for accessing CubeSigner APIs
    SolanaTxCmp:
      type: object
      properties:
        ignore_blockhash:
          type: boolean
          description: Whether the 'recent_blockhash' property of the Solana transaction is allowed to be different.
    TimeoutErrorCode:
      type: string
      enum:
      - PolicyEngineTimeout
      - WasmPolicyExecutionTimeout
    HttpRequest:
      type: object
      description: 'Information about the request.


        Captures all the relevant info (including the request body) about requests that require MFA.

        We use this to verify that when a request is resumed (after obtaining necessary MFA approvals)

        it is exactly the same as it originally was.'
      required:
      - method
      - path
      properties:
        body:
          type:
          - object
          - 'null'
          description: HTTP request body
        method:
          type: string
          description: HTTP method of the request
        path:
          type: string
          description: HTTP path of the re

# --- truncated at 32 KB (62 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/cubist/refs/heads/main/openapi/cubist-role-access-tokens-api-openapi.yml